High severity · published Dec 13, 2022
CVE-2022-41127
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
8.5
CVSS
1.7%
EPSS
No
On KEV
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
D3
Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) · Microsoft
15.0.0 before App Build 15.17.48428, Platform Build 15.0.48 · source: vendor
D3
Dynamics 365 Business Central Spring 2019 Update · Microsoft
14.0.0 before App Build 14.43.49498, Platform Build 14.0.49494 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2020 Release Wave 1 · Microsoft
16.0.0 before App Build 16.19.35126, Platform Build 16.35120 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2020 Release Wave 2 · Microsoft
17.0.0 before App Build 17.17.38111, Platform Build 17.0.38061 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2021 Release Wave 1 · Microsoft
18.0.0 before App Build 18.18.46920, Platform Build 18.0.46905 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2021 Release Wave 2 · Microsoft
19.0.0 before App Build 19.14.49970, Platform Build 19.0.49925 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2022 Release Wave 1 · Microsoft
20.0.0 before App Build 20.8.49971, Platform Build 20.0.49947 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2022 Release Wave 2 · Microsoft
21.0.0 before App Build 21.2.49990, Platform Build 21.0.49984 · source: vendor
MD
Microsoft Dynamics NAV 2013 R2 · Microsoft
1.0 before 52297 · source: vendor
MD
Microsoft Dynamics NAV 2015 · Microsoft
1.0 before 52204 · source: vendor
MD
Microsoft Dynamics NAV 2016 · Microsoft
1.0 before Build 52203 · source: vendor
MD
Microsoft Dynamics NAV 2017 · Microsoft
1.0 before Build 30712 · source: vendor
Affected product
D3
Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)
Microsoft